Threat mitigation system and method

Patent metadata

Field	Value
Publication number	US-12407716-B2
Application number	US-202418585687-A
Country	US
Kind code	B2
Filing date	Feb 23, 2024
Priority date	Feb 23, 2023
Publication date	Sep 2, 2025
Grant date	Sep 2, 2025

Abstract

A threat mitigation platform includes: an agent subsystem configured to generate an initial notification concerning a security event within a computing platform; a generative AI-based planner subsystem configured to receive the initial notification and generate a mitigation plan to address, in whole or in part, the security event within the computing platform; an executor subsystem configured to iteratively process the mitigation plan using a generative AI model to generate an output; and an output formatter subsystem configured to format the output and generate a summarized human-readable report for the initial notification.

First claim

What is claimed is:

1. A threat mitigation platform comprising:
an agent subsystem, comprising at least one processor coupled with a memory device, including one or more agents executed on one or more security-relevant subsystems, wherein the one or more agents are configured to generate an initial notification concerning a security event within a computing platform;
a generative AI-based planner subsystem including a plurality of generative AI models, wherein one or more of the plurality of generative AI models are configured to receive the initial notification and generate a mitigation plan to address, in whole or in part, the security event within the computing platform, including selecting a generative AI model from the plurality of generative AI models within a model repository based upon, at least in part, operation requirements;
an executor subsystem including the selected generative AI model, wherein the selected generative AI model is configured to iteratively process the mitigation plan to generate an output, wherein the selected generative AI model is further configured to utilize one or more tools to process the mitigation plan, wherein the one or more tools include:
a decompression tool to decompress a compressed initial notification; and
an identification tool to identify an owner of a domain associated with the initial notification; and

an output formatter subsystem including a large language model, wherein the large language model is configured to format the output and generate a summarized human-readable report for the initial notification.

2. The threat mitigation platform of claim 1 wherein the generative AI-based planner subsystem is configured to utilize one or more tools to process the initial notification.

3. The threat mitigation platform of claim 2 wherein the one or more tools includes one or more of:
a decoding tool to decode an encoded initial notification;
a decompression tool to decompress a compressed initial notification; and
an identification tool to identify an owner of a domain associated with the initial notification.

4. The threat mitigation platform of claim 1 wherein the one or more tools includes:
a decoding tool to decode an encoded initial notification.

5. The threat mitigation platform of claim 1 wherein the executor subsystem is configured to utilize several loops and/or nested loops to generate the output.

6. The threat mitigation platform of claim 1 wherein the output formatter subsystem is configured to utilize a formatting script to generate the summarized human-readable report for the initial notification.

7. The threat mitigation platform of claim 1 wherein the summarized human-readable report defines recommended next steps and/or disclaimers.

8. A threat mitigation platform comprising:
an agent subsystem, comprising at least one processor coupled with a memory device, including one or more agents executed on one or more security-relevant subsystems, wherein the one or more agents are configured to generate an initial notification concerning a security event within a computing platform;
a generative AI-based planner subsystem including a plurality of generative AI models, wherein one or more of the plurality of generative AI models are configured to receive the initial notification and generate a mitigation plan to address, in whole or in part, the security event within the computing platform, including selecting a generative AI model from the plurality of generative AI models within a model repository based upon, at least in part, operation requirements;
an executor subsystem including the selected generative AI model, wherein the selected generative AI model is configured to iteratively process the mitigation plan to generate an output, wherein the selected generative AI model is further configured to utilize one or more tools to process the mitigation plan, wherein the one or more tools include:
a decompression tool to decompress a compressed initial notification; and
an identification tool to identify an owner of a domain associated with the initial notification; and

an output formatter subsystem including a large language model, wherein the large language model is configured to format the output and generate a summarized human-readable report for the initial notification, wherein the summarized human-readable report defines recommended next steps and/or disclaimers.

9. The threat mitigation platform of claim 8 wherein the generative AI-based planner subsystem is configured to utilize one or more tools to process the initial notification.

10. The threat mitigation platform of claim 9 wherein the one or more tools includes:
a decoding tool to decode an encoded initial notification;
a decompression tool to decompress a compressed initial notification; and
an identification tool to identify an owner of a domain associated with the initial notification.

11. The threat mitigation platform of claim 8 wherein the one or more tools includes:
a decoding tool to decode an encoded initial notification.

12. The threat mitigation platform of claim 8 wherein the executor subsystem is configured to utilize several loops and/or nested loops to generate the output.

13. The threat mitigation platform of claim 8 wherein the output formatter subsystem is configured to utilize a formatting script to generate the summarized human-readable report for the initial notification.

14. A threat mitigation platform comprising:
an agent subsystem, comprising at least one processor coupled with a memory device, including one or more agents executed on one or more security-relevant subsystems, wherein the one or more agents are configured to generate an initial notification concerning a security event within a computing platform;
a generative AI-based planner subsystem including a plurality of generative AI models, wherein one or more of the plurality of generative AI models are configured to receive the initial notification and generate a mitigation plan to address, in whole or in part, the security event within the computing platform, including selecting a generative AI model from the plurality of generative AI models within a model repository based upon, at least in part, operation requirements;
an executor subsystem including the selected generative AI model, wherein the selected generative AI model is configured to iteratively process the mitigation plan to generate an output, wherein the selected generative AI model is further configured to utilize one or more tools to process the mitigation plan, wherein the one or more tools include:
a decompression tool to decompress a compressed initial notification; and
an identification tool to identify an owner of a domain associated with the initial notification; and

an output formatter subsystem including a large language model, wherein the large language model is configured to format the output and generate a summarized human-readable report for the initial notification, wherein:
the output formatter subsystem is configured to utilize a formatting script to generate the summarized human-readable report for the initial notification, and
the summarized human-readable report defines recommended next steps and/or disclaimers.

15. The threat mitigation platform of claim 14 wherein the generative AI-based planner subsystem is configured to utilize one or more tools to process the initial notification.

16. The threat mitigation platform of claim 15 wherein the one or more tools includes one or more of:
a decoding tool to decode an encoded initial notification;
a decompression tool to

Assignees

• Reliaquest Holdings Llc

Inventors

• Murphy Brian P
• Partlow Joe
• O'Connor Colin
• Pfeiffer Jason
• Murphy Brian Philip
• Echavarria Jonathan R

Classifications

• H04L41/16

  using machine learning or artificial intelligence · CPC title

• G06F40/56

  Natural language generation · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06N3/0475 Primary

  Generative networks · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title